Benefit Plans Administrative Services 12/26/2018

151Pagc Attachment A—Business Associate Agreement This HIPAA Business Associate Agreement ("Agreement") supplements and is made a part of the Administrative Service Agreement ("Service Agreement") by and between BPAS ("Business Associate") and the Parties identified on the execution page ("Client") acting on behalf of the City of Everett VEBA Plan ("Covered Entity"), and is effective as of January 1, 2019 (the "Effective Date"). This Agreement supersedes any prior HIPAA business associate agreement between the parties. RECITALS WHEREAS, Business Associate provides third party administration services to employers sponsoring health reimbursement arrangements; and WHEREAS, Business Associate has been retained by Client to perform functions or activities that require that Business Associate have access to Protected Health Information in relation to the Covered Entity; and WHEREAS, Business Associate and Client desire to amend and restate the Agreement currently in effect in order to incorporate the changes to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") as set forth in the final regulations issued by the Department of Health and Human Services on January 25, 2013 implementing the Health Information Technology for Economic and Clinical Health Act ("HITECH") provisions of the American Recovery and Reinvestment Act of 2009; and WHEREAS, the parties agree that Business Associate acts in the capacity of an independent contractor in relation to the services provided to Client and Covered Entity under the Service Agreement. NOW, THEREFORE, in consideration of the mutual covenants, terms and conditions herein contained, the parties hereto agree as follows: 1. DEFINITIONS. Terms used but not otherwise defined in the Agreement shall have the same meaning as those terms in the Privacy Rule and Security Rule. a. "Breach" shall have the meaning given to it by 45 CFR Section 164.402. b. "Business Associate" shall mean BPAS, a third party administrator. c. " Covered Entity" shall mean the City of Everett VEBA Plan Reimbursement Arrangement. The Board of Trustees of the City of Everett VEBA Plan and Trust serves as plan sponsor of this plan. d. "De-identified Data" shall have the same meaning as the term "de-identified data" in 45 CFR Section 164.514. e. "Designated Record Set" shall mean a group of records maintained by or for a Covered Entity that is: (i) the medical records and billing records about Individuals maintained by or for a covered health care provider; (ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) used, in whole or in part, by or for the Covered Entity to make decisions about Individuals. For purposes of this definition, the term "record" means any item, collection, or grouping of information that includes Protected Health Information and is maintained, collected, used, or disseminated by or for a Covered Entity. VEBA Administrative Service Agreement (405512)